Strapi Cleartext Storage of Sensitive Information Vulnerability
What's happening and what to do
Attackers who can log into the Strapi admin panel can use query filters to read sensitive user details stored in cleartext, and it is being exploited in the wild and can be chained toward remote code execution. Strapi (npm package @strapi/strapi), versions 3.2.1 up to but not including 4.8.0. Upgrade @strapi/strapi to 4.8.0 or later now, and check for signs of compromise such as unexpected admin logins or unusual query activity.
AI summary of the sources on this page. Regenerated when a source changes.
Affected versions
| Ecosystem | Package | Affected | Safe from |
|---|---|---|---|
| npm | @strapi/strapi | >= 3.2.1 < 4.8.0 | 4.8.0 |
Signals over time
- 2026-10-08Added to CISA's Known Exploited Vulnerabilities catalog.
- 2026-10-11Federal patch deadline for US agencies.
- 2026-11-03 21:55First seen here.
Source text
Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution.